diff --git a/flake.nix b/flake.nix
index aa0caea..c03d5d2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -238,29 +238,35 @@
           { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
           {
             age.secrets = {
-              forgejo-internal-token = {
-                file = ./secrets/forgejo-internal-token.age;
-                mode = "440";
+              postgres-forgejo = {
+                file = ./secrets/postgres-forgejo.age;
                 owner = "forgejo";
                 group = "forgejo";
+                mode = "0400";
+              };
+              forgejo-internal-token = {
+                file = ./secrets/forgejo-internal-token.age;
+                owner = "forgejo";
+                group = "forgejo";
+                mode = "0440";
               };
               forgejo-secret-key = {
                 file = ./secrets/forgejo-secret-key.age;
-                mode = "440";
                 owner = "forgejo";
                 group = "forgejo";
+                mode = "0440";
               };
               forgejo-runner-token-snowden = {
                 file = ./secrets/forgejo-runner-token-snowden.age;
-                mode = "444";
                 owner = "root";
                 group = "root";
+                mode = "0444";
               };
               forgejo-runner-token-snowden-env = {
                 file = ./secrets/forgejo-runner-token-snowden-env.age;
-                mode = "444";
                 owner = "root";
                 group = "root";
+                mode = "0444";
               };
             };
           }
diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix
index 1a78101..c358b1d 100644
--- a/hosts/git/forgejo.nix
+++ b/hosts/git/forgejo.nix
@@ -51,7 +51,7 @@ in
         createDatabase = false;
         host = "sql.${config.networking.domain}";
         name = "git";
-        passwordFile = config.age.secrets.postgresql_forgejo.path;
+        passwordFile = config.age.secrets.postgresql-forgejo.path;
         port = 5432;
         user = "git";
         type = "postgres";